The CVSS 5.4 rating for this stored XSS in Johnson Controls FM Systems Employee deserves skepticism, particularly given the industrial facility context. Stored XSS consistently achieves higher real-world impact than base scoring suggests because exploitation requires zero user interaction beyond page render—the payload persists and executes for every subsequent viewer. The 5.4 score reflects a constrained attack surface calculation, but this scoring framework was built for general web applications, not for facilities management systems that integrate with building automation, HVAC controls, or physical access infrastructure.
The critical question is whether FM Systems Employee shares authentication contexts, session tokens, or API pathways with other Johnson Controls building management components. If an attacker can harvest admin sessions via stored XSS in FM Systems, the pivot potential into physical security systems becomes a materially different risk profile than the CVSS implies. The vendor's fix in version 2025.3.1 warrants independent review—not just to confirm XSS sanitization was applied, but to verify whether SameSite cookie attributes, CSRF token hardening, or session binding to device fingerprints were introduced. Patching the XSS vulnerability without hardening the surrounding session architecture may close one vector while leaving credential harvesting pathways exploitable.
Beyond the patch itself, the deployment window matters more than the CVE score. Facilities management software rarely receives the same patching urgency as endpoint security tools. Organizations running FM Systems on building automation networks may still be on pre-2025.3.1 versions because patching requires regression testing against connected HVAC or physical access integrations. The real risk is not whether the vulnerability exists in the current patch—the question is how many FM Systems instances remain exploitable in production environments right now because the remediation window between patch availability and actual deployment is where exposure compounds. Verify your deployment version, examine whether 2025.3.1 hardened session architecture beyond the XSS fix, and treat any FM Systems instance not on the current release as an active exposure window.